N1NJ10

Nmap CheatSheet

Resources

Commands

  • Ping Sweep a Subnet
    • Scans a CIDR range, saves output to tnet files, and extracts live hosts. 
      nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
  • Ping Sweep from a List
    • Same as above, but reads targets from a file. 
      nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5
  • Ping Sweep Multiple IPs
    • Scans specified individual IP addresses. 
      nmap -sn -oA tnet 10.129.2.18 10.129.2.19 10.129.2.20| grep for | cut -d" " -f5
  • ICMP Echo Request
    • Uses -PE for a standard ping, --packet-trace to see the packets, and --reason to understand why a host is up or down. 
      nmap 10.129.2.18 -sn -oA host -PE --packet-trace --reason
    • Add --disable-arp-ping to rely only on ICMP on a local network. 
      nmap 10.129.2.18 -sn -oA host -PE --packet-trace --disable-arp-ping
  • Scan All Ports & Save All Formats
    • The -p- flag scans all 65,535 TCP ports. -oA saves the output in Normal, XML, and Grepable formats. 
      nmap 10.129.2.28 -p- -oA target
  • Convert XML to HTML Report
    • Creates a user-friendly HTML report from the XML output. 
      xsltproc target.xml -o target.html
  • Detailed Version Scan
    • Disables ping (-Pn), DNS resolution (-n), and ARP ping. Focuses on a specific port (-p 445) and shows packet trace and reason. 
      nmap 10.129.2.28 -Pn -n --disable-arp-ping --packet-trace -p 445 --reason -sV
  • Noisy Version Scan
    • --version-all increases intensity. --data-length adds junk data to packets. 
      nmap -sV --version-all --data-length 20 -p 22,80,443 192.168.1.100
  • Show Scan Statistics
    • --stats-every=5s provides a progress update every 5 seconds. 
      nmap 10.129.2.28 -p- -sV --stats-every=5s
  • Fast Scans (Top Ports)
    • -F scans the top 100 ports. The timeout options make it faster on reliable networks. 
      nmap 10.129.2.0/24 -F --initial-rtt-timeout 50ms --max-rtt-timeout 100ms
  • No Retries
    • --max-retries 0 tells Nmap not to retry sending a packet if no response is received. Good for quick scans where accuracy is less critical. 
      nmap 10.129.2.0/24 -F --max-retries 0
  • Guaranteed Scan Rate
    • --min-rate 300 ensures Nmap sends at least 300 packets per second. 
      nmap 10.129.2.0/24 -F -oN tnet.minrate300 --min-rate 300
  • Rapid Initial Mass-Scan (RIM Sweep)

    What is a RIM Sweep? --min-hostgroup and --min-rate are increased dramatically to scan in parallel at high speed.

    This technique is for rapidly scanning large numbers of hosts for a few key ports. 

    nmap -Pn -n -p 22,80,443,3389,2222 -iL discovery/ranges.txt -oA discovery/hosts/rmisweep --min-hostgroup 256 --min-rate 1280
  • Large Network Discovery
    • This is designed for huge ranges like a /16. 
      # First, find gateways
grep 'Up' gateways.gnmap | cut -d' ' -f2 > ranges.txt
# Then format for scanning
sed -i ranges.txt -e 's/$/\/24/'
# Scan the discovered subnets
nmap -sn 10.0-255.0-255.1 -PE --min-hostgroup 10000 --min-rate 10000
  • Packet Fragmentation
    • -f splits packets into smaller fragments. --mtu 16 sets a specific (and small) Maximum Transmission Unit. 
      nmap -f 192.168.0.1
nmap --mtu 16 192.168.0.1
  • Packet & Data Manipulation
    • Change the outgoing source port, often to a common one like 53 (DNS). 
      nmap --source-port 53 192.168.0.1
    • Add random or specific data to packets to make them look more legitimate. 
      # Add 25 bytes of random data
nmap --data-length 25 192.168.0.1
# Add a specific hex string (HTTP/1.1)
nmap --data 0x485454502F312E310D0A -p 80 192.168.1.100
# Add a specific string
nmap --data-string "GET / HTTP/1.1" -p 80 192.168.1.100
  • Decoys & IP Spoofing
    • Hide your real IP among a series of decoys. RND:5 creates 5 random, alive hosts as decoys. 
      nmap 10.129.2.28 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5
    • Set a specific source IP address (-S) and interface (-e). 
      nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0
  • Vulnerability Scanning
    • --script vuln runs all scripts in the “vuln” category against open ports. 
      nmap 10.129.2.28 -p 80 -sV --script vuln

Field Notes & Theory

Default Scan Behavior

By default, nmap <target> scans the top 1000 TCP ports using a SYN scan (-sS).

Understanding Port States

Nmap only reports a port as closed when it receives a definitive RST (reset) packet in response. If a firewall blocks the port or no response is received, Nmap will report it as filtered.

Timing Templates ( -T parameter)

Nmap has preset timing templates for convenience, from slowest/stealthiest to fastest/noisiest.

  • -T0: paranoid (very slow, for IDS evasion)
  • -T1: sneaky
  • -T2: polite (reduces network load)
  • -T3: normal (default)
  • -T4: aggressive (assumes a fast, reliable network)
  • -T5: insane (very aggressive, may sacrifice accuracy)

Blending In with -sT

A good way to avoid some detection for TCP scans is to use the TCP Connect scan (-sT) instead of the default SYN scan (-sS). This uses your operating system’s native socket calls to make full connections, which can make the scan traffic blend in with other legitimate client connections.

Table of the Ports State

Screenshot — Field Notes & Theory

Graph View

Backlinks